Boundaries of flow table usage reduction algorithms based on elephant flow detection

The majority of Internet traffic is caused by a relatively small number of flows (so-called elephant flows). This phenomenon can be exploited to facilitate traffic engineering: resource-costly individual flow forwarding entries can be created only for elephants while serving mice over the shortest paths. Although this idea already appeared in proposed TE systems, it was not examined by itself. It remains unknown what extent of flow table occupancy and operations number reduction can be achieved or how to select thresholds or sampling rates to cover the desired fraction of traffic. In this paper, we use reproducible traffic models obtained from a 30-day-long campus trace covering 4 billion flows, to answer these questions. We establish theoretical boundaries for flow table usage reduction algorithms that classify flows since the first packet, after reaching a predefined counter threshold or detect elephants by sampling. An important finding is that simple packet sampling performs surprisingly well on realistic traffic, reducing the number of flow entries by a factor up to 400, still covering 80% of the traffic. We also provide an open-source software package allowing the replication of our experiments or the performing of similar evaluations for other algorithms or flow distributions.